pochita-ethereum[.]ai-cryptolist[.]net

PhishDestroy has identified a phishing domain impersonating Ethereum: pochita-ethereum.ai-cryptolist.net. This brand impersonation threat is designed to trick users into believing they are interacting with legitimate Ethereum services, likely to deploy crypto drainer scripts that steal wallet credentials or funds. The domain was created on April 11, 2026 and resolves to IP address 104.21.68.219. It is registered through Key-Systems GmbH and uses an SSL certificate from Google Trust Services (WE1). The page title observed was 'Just a moment...', a common tactic to evade automated scanners.

Technical analysis reveals that VirusTotal flagged this domain with 2 out of 95 security vendors, indicating moderate detection coverage. It appears on 1 security blocklist, suggesting limited but active malicious use. Google Safe Browsing status is not provided, but given the risk level, it is likely compromised. The domain's infrastructure and impersonation of Ethereum make it a credible threat to crypto users. The seed for this analysis is 77078a.

Currently, the domain is offline, indicating that mitigation actions have been taken, possibly by the hosting provider or registrar. Despite this, users should remain vigilant as similar domains may reappear. To stay safe, always verify URLs on PhishDestroy before interacting with any Ethereum-related sites. Avoid clicking links from unsolicited messages and use hardware wallets for transactions. If you have interacted with this domain, immediately revoke any permissions and transfer funds to a new wallet.